gitnexus 1.6.4-rc.99 → 1.6.4

package/dist/core/wiki/llm-client.js

@@ -1,4 +1,5 @@
 import { logger } from '../logger.js';
+import { CircuitOpenError, ResilientFetchExhaustedError, resilientFetch } from '../../_shared/index.js';
 /**
  * Resolve LLM configuration from env vars, saved config, and optional overrides.
  * Priority: overrides (CLI flags) > env vars > ~/.gitnexus/config.json > error
@@ -37,6 +38,45 @@ export async function resolveLLMConfig(overrides) {
 export function estimateTokens(text) {
     return Math.ceil(text.length / 4);
 }
+/**
+ * Validate that a base URL supplied for LLM API calls is a safe HTTP/HTTPS
+ * endpoint (CWE-918 / CodeQL js/http-to-file-access).
+ *
+ * Allowed:
+ *  - https:// with any hostname (public LLM APIs, Azure, OpenRouter, …)
+ *  - http:// restricted to localhost / 127.0.0.1 (local servers: Ollama, LiteLLM, …)
+ *
+ * Rejected:
+ *  - file://, data:, javascript:, and any other non-HTTP scheme
+ *  - http:// aimed at non-loopback hosts (avoids SSRF against internal networks)
+ *
+ * Throws with a descriptive message on validation failure so callers surface a
+ * clear error rather than an opaque network error.
+ */
+export function validateLLMBaseUrl(baseUrl) {
+    let parsed;
+    try {
+        parsed = new URL(baseUrl);
+    }
+    catch {
+        // Do not include the raw input in the message — it may contain credentials.
+        throw new Error('Invalid LLM base URL: must be a well-formed http:// or https:// URL');
+    }
+    if (!['https:', 'http:'].includes(parsed.protocol)) {
+        // Use parsed.protocol only (scheme), not the full URL, to avoid leaking credentials.
+        throw new Error(`LLM base URL must use http:// or https:// (got ${parsed.protocol})`);
+    }
+    if (parsed.protocol === 'http:') {
+        // Node's URL parser preserves IPv6 brackets in hostname (e.g. "[::1]"),
+        // so strip them before comparing to bare address literals.
+        const host = parsed.hostname.toLowerCase().replace(/^\[|\]$/g, '');
+        if (host !== 'localhost' && host !== '127.0.0.1' && host !== '::1') {
+            // Use parsed.origin (scheme+host+port, no credentials) instead of the full URL.
+            throw new Error(`Insecure http:// LLM base URLs are only allowed for localhost/127.0.0.1. ` +
+                `Use https:// for remote endpoints (got ${parsed.origin})`);
+        }
+    }
+}
 /**
  * Returns true if the given base URL is an Azure OpenAI endpoint.
  * Uses proper hostname matching to avoid spoofed URLs like
@@ -78,6 +118,8 @@ export function buildRequestUrl(baseUrl, apiVersion) {
  * Retries up to 3 times on transient failures (429, 5xx, network errors).
  */
 export async function callLLM(prompt, config, systemPrompt, options) {
+    // Validate base URL before any fetch (CodeQL js/http-to-file-access)
+    validateLLMBaseUrl(config.baseUrl);
     const messages = [];
     if (systemPrompt) {
         messages.push({ role: 'system', content: systemPrompt });
@@ -110,69 +152,68 @@ export async function callLLM(prompt, config, systemPrompt, options) {
     const authHeaders = azure
         ? { 'api-key': config.apiKey }
         : { Authorization: `Bearer ${config.apiKey}` };
-    const MAX_RETRIES = 3;
-    let lastError = null;
-    for (let attempt = 0; attempt < MAX_RETRIES; attempt++) {
-        try {
-            const response = await fetch(url, {
-                method: 'POST',
-                headers: {
-                    'Content-Type': 'application/json',
-                    ...authHeaders,
-                },
-                body: JSON.stringify(body),
-            });
-            if (!response.ok) {
-                const errorText = await response.text().catch(() => 'unknown error');
-                // Azure content filter — surface a clear message instead of a generic API error
-                if (azure &&
-                    response.status === 400 &&
-                    (errorText.includes('content_filter') ||
-                        errorText.includes('ResponsibleAIPolicyViolation'))) {
-                    throw new Error(`Azure content filter blocked this request. The prompt triggered content policy. Details: ${errorText.slice(0, 300)}`);
-                }
-                // Rate limit — wait with exponential backoff and retry
-                if (response.status === 429 && attempt < MAX_RETRIES - 1) {
-                    const retryAfter = parseInt(response.headers.get('retry-after') || '0', 10);
-                    const delay = retryAfter > 0 ? retryAfter * 1000 : 2 ** attempt * 3000;
-                    await sleep(delay);
-                    continue;
-                }
-                // Server error — retry with backoff
-                if (response.status >= 500 && attempt < MAX_RETRIES - 1) {
-                    await sleep((attempt + 1) * 2000);
-                    continue;
-                }
-                throw new Error(`LLM API error (${response.status}): ${errorText.slice(0, 500)}`);
-            }
-            // Streaming path
-            if (useStream && response.body) {
-                return await readSSEStream(response.body, options.onChunk);
-            }
-            // Non-streaming path
-            const json = (await response.json());
-            const choice = json.choices?.[0];
-            if (!choice?.message?.content) {
-                throw new Error('LLM returned empty response');
-            }
-            return {
-                content: choice.message.content,
-                promptTokens: json.usage?.prompt_tokens,
-                completionTokens: json.usage?.completion_tokens,
-            };
+    // Network resilience (bounded retries with exponential-backoff jitter,
+    // 5xx + 429 + Retry-After handling, in-process circuit breaker on the
+    // LLM endpoint) is delegated to resilientFetch. Provider-specific
+    // error parsing (Azure content filter, empty-content checks) stays
+    // here since it requires response-body inspection.
+    let response;
+    try {
+        response = await resilientFetch(url, {
+            method: 'POST',
+            headers: {
+                'Content-Type': 'application/json',
+                ...authHeaders,
+            },
+            body: JSON.stringify(body),
+            // Per-attempt timeout. Without this each retry can hang
+            // indefinitely on a frozen TCP connection — the per-call
+            // signal is the only timeout `resilientFetch` honors;
+            // `capDelayMs` only bounds the *backoff* between attempts.
+            // 60s matches typical LLM completion budgets.
+            signal: AbortSignal.timeout(60_000),
+        }, {
+            breakerKey: `wiki-llm-${new URL(url).host}`,
+            retry: { maxAttempts: 3, baseDelayMs: 2_000, capDelayMs: 30_000 },
+        });
+    }
+    catch (err) {
+        if (err instanceof CircuitOpenError) {
+            throw new Error(`LLM endpoint circuit open: retry in ${Math.ceil(err.retryAfterMs / 1000)}s. ${err.message}`);
         }
-        catch (err) {
-            lastError = err;
-            // Network error — retry with backoff
-            if (attempt < MAX_RETRIES - 1 &&
-                (err.code === 'ECONNREFUSED' || err.code === 'ETIMEDOUT' || err.message?.includes('fetch'))) {
-                await sleep((attempt + 1) * 3000);
-                continue;
-            }
-            throw err;
+        if (err instanceof ResilientFetchExhaustedError) {
+            const errorText = await err.response.text().catch(() => 'unknown error');
+            throw new Error(`LLM API error (${err.response.status} after retries): ${errorText.slice(0, 500)}`);
+        }
+        throw err;
+    }
+    if (!response.ok) {
+        const errorText = await response.text().catch(() => 'unknown error');
+        // Azure content filter — surface a clear message instead of a generic API error.
+        if (azure &&
+            response.status === 400 &&
+            (errorText.includes('content_filter') || errorText.includes('ResponsibleAIPolicyViolation'))) {
+            throw new Error(`Azure content filter blocked this request. The prompt triggered content policy. Details: ${errorText.slice(0, 300)}`);
         }
+        // Any other non-OK response here is a terminal 4xx — resilientFetch
+        // already retried 5xx/429 to exhaustion and would have thrown above.
+        throw new Error(`LLM API error (${response.status}): ${errorText.slice(0, 500)}`);
+    }
+    // Streaming path
+    if (useStream && response.body) {
+        return await readSSEStream(response.body, options.onChunk);
     }
-    throw lastError || new Error('LLM call failed after retries');
+    // Non-streaming path
+    const json = (await response.json());
+    const choice = json.choices?.[0];
+    if (!choice?.message?.content) {
+        throw new Error('LLM returned empty response');
+    }
+    return {
+        content: choice.message.content,
+        promptTokens: json.usage?.prompt_tokens,
+        completionTokens: json.usage?.completion_tokens,
+    };
 }
 /**
  * Read an SSE stream from an OpenAI-compatible streaming response.
@@ -224,6 +265,3 @@ async function readSSEStream(body, onChunk) {
     }
     return { content };
 }
-function sleep(ms) {
-    return new Promise((resolve) => setTimeout(resolve, ms));
-}

package/dist/server/api.js

@@ -638,7 +638,11 @@ export const createServer = async (port, host = '127.0.0.1') => {
                     (job.repoPath && path.basename(job.repoPath).toLowerCase() === lower);
                 if (isMatch && ['queued', 'cloning', 'analyzing'].includes(job.status)) {
                     if (process.env.DEBUG) {
-                        console.log(`[debug] resolveRepo waiting for active job ${job.id} (${normalizedName})...`);
+                        // Sanitize user-controlled values to prevent log injection (CodeQL js/log-injection).
+                        logger.debug({
+                            jobId: String(job.id).replace(/[\r\n]/g, ' '),
+                            repoName: String(normalizedName).replace(/[\r\n]/g, ' '),
+                        }, '[debug] resolveRepo waiting for active job');
                     }
                     for (let wait = 0; wait < HOLD_QUEUE_TIMEOUT_SECS; wait++) {
                         if (clientGone)
@@ -662,7 +666,8 @@ export const createServer = async (port, host = '127.0.0.1') => {
         // (e.g. registry file not yet flushed after clone completes).
         if (!found && normalizedName && !isRetry) {
             if (process.env.DEBUG) {
-                console.log(`[debug] resolveRepo 404 for "${normalizedName}". Triggering deep init...`);
+                // Sanitize user-controlled values to prevent log injection (CodeQL js/log-injection).
+                logger.debug({ repoName: String(normalizedName).replace(/[\r\n]/g, ' ') }, '[debug] resolveRepo 404, triggering deep init');
             }
             await backend.init();
             return await resolveRepo(normalizedName, true, req);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "gitnexus",
-  "version": "1.6.4-rc.99",
+  "version": "1.6.4",
   "description": "Graph-powered code intelligence for AI agents. Index any codebase, query via MCP or CLI.",
   "author": "Abhigyan Patwari",
   "license": "PolyForm-Noncommercial-1.0.0",
@@ -116,6 +116,6 @@
     }
   },
   "engines": {
-    "node": ">=20.0.0"
+    "node": ">=22.0.0"
   }
 }

package/vendor/node_modules/node-addon-api/node_addon_api.target.mk

@@ -34,16 +34,17 @@ CFLAGS_C_Debug :=
 CFLAGS_CC_Debug := \
 	-fno-rtti \
 	-fno-exceptions \
+	-fno-strict-aliasing \
 	-std=gnu++17
 
 INCS_Debug := \
-	-I/home/runner/.cache/node-gyp/20.20.2/include/node \
-	-I/home/runner/.cache/node-gyp/20.20.2/src \
-	-I/home/runner/.cache/node-gyp/20.20.2/deps/openssl/config \
-	-I/home/runner/.cache/node-gyp/20.20.2/deps/openssl/openssl/include \
-	-I/home/runner/.cache/node-gyp/20.20.2/deps/uv/include \
-	-I/home/runner/.cache/node-gyp/20.20.2/deps/zlib \
-	-I/home/runner/.cache/node-gyp/20.20.2/deps/v8/include
+	-I/home/runner/.cache/node-gyp/22.22.2/include/node \
+	-I/home/runner/.cache/node-gyp/22.22.2/src \
+	-I/home/runner/.cache/node-gyp/22.22.2/deps/openssl/config \
+	-I/home/runner/.cache/node-gyp/22.22.2/deps/openssl/openssl/include \
+	-I/home/runner/.cache/node-gyp/22.22.2/deps/uv/include \
+	-I/home/runner/.cache/node-gyp/22.22.2/deps/zlib \
+	-I/home/runner/.cache/node-gyp/22.22.2/deps/v8/include
 
 DEFS_Release := \
 	'-DNODE_GYP_MODULE_NAME=node_addon_api' \
@@ -75,16 +76,17 @@ CFLAGS_C_Release :=
 CFLAGS_CC_Release := \
 	-fno-rtti \
 	-fno-exceptions \
+	-fno-strict-aliasing \
 	-std=gnu++17
 
 INCS_Release := \
-	-I/home/runner/.cache/node-gyp/20.20.2/include/node \
-	-I/home/runner/.cache/node-gyp/20.20.2/src \
-	-I/home/runner/.cache/node-gyp/20.20.2/deps/openssl/config \
-	-I/home/runner/.cache/node-gyp/20.20.2/deps/openssl/openssl/include \
-	-I/home/runner/.cache/node-gyp/20.20.2/deps/uv/include \
-	-I/home/runner/.cache/node-gyp/20.20.2/deps/zlib \
-	-I/home/runner/.cache/node-gyp/20.20.2/deps/v8/include
+	-I/home/runner/.cache/node-gyp/22.22.2/include/node \
+	-I/home/runner/.cache/node-gyp/22.22.2/src \
+	-I/home/runner/.cache/node-gyp/22.22.2/deps/openssl/config \
+	-I/home/runner/.cache/node-gyp/22.22.2/deps/openssl/openssl/include \
+	-I/home/runner/.cache/node-gyp/22.22.2/deps/uv/include \
+	-I/home/runner/.cache/node-gyp/22.22.2/deps/zlib \
+	-I/home/runner/.cache/node-gyp/22.22.2/deps/v8/include
 
 OBJS :=
 

package/vendor/node_modules/node-addon-api/node_addon_api_except.target.mk

@@ -34,16 +34,17 @@ CFLAGS_C_Debug :=
 CFLAGS_CC_Debug := \
 	-fno-rtti \
 	-fno-exceptions \
+	-fno-strict-aliasing \
 	-std=gnu++17
 
 INCS_Debug := \
-	-I/home/runner/.cache/node-gyp/20.20.2/include/node \
-	-I/home/runner/.cache/node-gyp/20.20.2/src \
-	-I/home/runner/.cache/node-gyp/20.20.2/deps/openssl/config \
-	-I/home/runner/.cache/node-gyp/20.20.2/deps/openssl/openssl/include \
-	-I/home/runner/.cache/node-gyp/20.20.2/deps/uv/include \
-	-I/home/runner/.cache/node-gyp/20.20.2/deps/zlib \
-	-I/home/runner/.cache/node-gyp/20.20.2/deps/v8/include
+	-I/home/runner/.cache/node-gyp/22.22.2/include/node \
+	-I/home/runner/.cache/node-gyp/22.22.2/src \
+	-I/home/runner/.cache/node-gyp/22.22.2/deps/openssl/config \
+	-I/home/runner/.cache/node-gyp/22.22.2/deps/openssl/openssl/include \
+	-I/home/runner/.cache/node-gyp/22.22.2/deps/uv/include \
+	-I/home/runner/.cache/node-gyp/22.22.2/deps/zlib \
+	-I/home/runner/.cache/node-gyp/22.22.2/deps/v8/include
 
 DEFS_Release := \
 	'-DNODE_GYP_MODULE_NAME=node_addon_api_except' \
@@ -75,16 +76,17 @@ CFLAGS_C_Release :=
 CFLAGS_CC_Release := \
 	-fno-rtti \
 	-fno-exceptions \
+	-fno-strict-aliasing \
 	-std=gnu++17
 
 INCS_Release := \
-	-I/home/runner/.cache/node-gyp/20.20.2/include/node \
-	-I/home/runner/.cache/node-gyp/20.20.2/src \
-	-I/home/runner/.cache/node-gyp/20.20.2/deps/openssl/config \
-	-I/home/runner/.cache/node-gyp/20.20.2/deps/openssl/openssl/include \
-	-I/home/runner/.cache/node-gyp/20.20.2/deps/uv/include \
-	-I/home/runner/.cache/node-gyp/20.20.2/deps/zlib \
-	-I/home/runner/.cache/node-gyp/20.20.2/deps/v8/include
+	-I/home/runner/.cache/node-gyp/22.22.2/include/node \
+	-I/home/runner/.cache/node-gyp/22.22.2/src \
+	-I/home/runner/.cache/node-gyp/22.22.2/deps/openssl/config \
+	-I/home/runner/.cache/node-gyp/22.22.2/deps/openssl/openssl/include \
+	-I/home/runner/.cache/node-gyp/22.22.2/deps/uv/include \
+	-I/home/runner/.cache/node-gyp/22.22.2/deps/zlib \
+	-I/home/runner/.cache/node-gyp/22.22.2/deps/v8/include
 
 OBJS :=
 

package/vendor/node_modules/node-addon-api/node_addon_api_except_all.target.mk

@@ -34,16 +34,17 @@ CFLAGS_C_Debug :=
 CFLAGS_CC_Debug := \
 	-fno-rtti \
 	-fno-exceptions \
+	-fno-strict-aliasing \
 	-std=gnu++17
 
 INCS_Debug := \
-	-I/home/runner/.cache/node-gyp/20.20.2/include/node \
-	-I/home/runner/.cache/node-gyp/20.20.2/src \
-	-I/home/runner/.cache/node-gyp/20.20.2/deps/openssl/config \
-	-I/home/runner/.cache/node-gyp/20.20.2/deps/openssl/openssl/include \
-	-I/home/runner/.cache/node-gyp/20.20.2/deps/uv/include \
-	-I/home/runner/.cache/node-gyp/20.20.2/deps/zlib \
-	-I/home/runner/.cache/node-gyp/20.20.2/deps/v8/include
+	-I/home/runner/.cache/node-gyp/22.22.2/include/node \
+	-I/home/runner/.cache/node-gyp/22.22.2/src \
+	-I/home/runner/.cache/node-gyp/22.22.2/deps/openssl/config \
+	-I/home/runner/.cache/node-gyp/22.22.2/deps/openssl/openssl/include \
+	-I/home/runner/.cache/node-gyp/22.22.2/deps/uv/include \
+	-I/home/runner/.cache/node-gyp/22.22.2/deps/zlib \
+	-I/home/runner/.cache/node-gyp/22.22.2/deps/v8/include
 
 DEFS_Release := \
 	'-DNODE_GYP_MODULE_NAME=node_addon_api_except_all' \
@@ -75,16 +76,17 @@ CFLAGS_C_Release :=
 CFLAGS_CC_Release := \
 	-fno-rtti \
 	-fno-exceptions \
+	-fno-strict-aliasing \
 	-std=gnu++17
 
 INCS_Release := \
-	-I/home/runner/.cache/node-gyp/20.20.2/include/node \
-	-I/home/runner/.cache/node-gyp/20.20.2/src \
-	-I/home/runner/.cache/node-gyp/20.20.2/deps/openssl/config \
-	-I/home/runner/.cache/node-gyp/20.20.2/deps/openssl/openssl/include \
-	-I/home/runner/.cache/node-gyp/20.20.2/deps/uv/include \
-	-I/home/runner/.cache/node-gyp/20.20.2/deps/zlib \
-	-I/home/runner/.cache/node-gyp/20.20.2/deps/v8/include
+	-I/home/runner/.cache/node-gyp/22.22.2/include/node \
+	-I/home/runner/.cache/node-gyp/22.22.2/src \
+	-I/home/runner/.cache/node-gyp/22.22.2/deps/openssl/config \
+	-I/home/runner/.cache/node-gyp/22.22.2/deps/openssl/openssl/include \
+	-I/home/runner/.cache/node-gyp/22.22.2/deps/uv/include \
+	-I/home/runner/.cache/node-gyp/22.22.2/deps/zlib \
+	-I/home/runner/.cache/node-gyp/22.22.2/deps/v8/include
 
 OBJS :=
 

package/vendor/node_modules/node-addon-api/node_addon_api_maybe.target.mk

@@ -34,16 +34,17 @@ CFLAGS_C_Debug :=
 CFLAGS_CC_Debug := \
 	-fno-rtti \
 	-fno-exceptions \
+	-fno-strict-aliasing \
 	-std=gnu++17
 
 INCS_Debug := \
-	-I/home/runner/.cache/node-gyp/20.20.2/include/node \
-	-I/home/runner/.cache/node-gyp/20.20.2/src \
-	-I/home/runner/.cache/node-gyp/20.20.2/deps/openssl/config \
-	-I/home/runner/.cache/node-gyp/20.20.2/deps/openssl/openssl/include \
-	-I/home/runner/.cache/node-gyp/20.20.2/deps/uv/include \
-	-I/home/runner/.cache/node-gyp/20.20.2/deps/zlib \
-	-I/home/runner/.cache/node-gyp/20.20.2/deps/v8/include
+	-I/home/runner/.cache/node-gyp/22.22.2/include/node \
+	-I/home/runner/.cache/node-gyp/22.22.2/src \
+	-I/home/runner/.cache/node-gyp/22.22.2/deps/openssl/config \
+	-I/home/runner/.cache/node-gyp/22.22.2/deps/openssl/openssl/include \
+	-I/home/runner/.cache/node-gyp/22.22.2/deps/uv/include \
+	-I/home/runner/.cache/node-gyp/22.22.2/deps/zlib \
+	-I/home/runner/.cache/node-gyp/22.22.2/deps/v8/include
 
 DEFS_Release := \
 	'-DNODE_GYP_MODULE_NAME=node_addon_api_maybe' \
@@ -75,16 +76,17 @@ CFLAGS_C_Release :=
 CFLAGS_CC_Release := \
 	-fno-rtti \
 	-fno-exceptions \
+	-fno-strict-aliasing \
 	-std=gnu++17
 
 INCS_Release := \
-	-I/home/runner/.cache/node-gyp/20.20.2/include/node \
-	-I/home/runner/.cache/node-gyp/20.20.2/src \
-	-I/home/runner/.cache/node-gyp/20.20.2/deps/openssl/config \
-	-I/home/runner/.cache/node-gyp/20.20.2/deps/openssl/openssl/include \
-	-I/home/runner/.cache/node-gyp/20.20.2/deps/uv/include \
-	-I/home/runner/.cache/node-gyp/20.20.2/deps/zlib \
-	-I/home/runner/.cache/node-gyp/20.20.2/deps/v8/include
+	-I/home/runner/.cache/node-gyp/22.22.2/include/node \
+	-I/home/runner/.cache/node-gyp/22.22.2/src \
+	-I/home/runner/.cache/node-gyp/22.22.2/deps/openssl/config \
+	-I/home/runner/.cache/node-gyp/22.22.2/deps/openssl/openssl/include \
+	-I/home/runner/.cache/node-gyp/22.22.2/deps/uv/include \
+	-I/home/runner/.cache/node-gyp/22.22.2/deps/zlib \
+	-I/home/runner/.cache/node-gyp/22.22.2/deps/v8/include
 
 OBJS :=